MY/SG Invoice & Receipt Parser

Extract structured data from Malaysian & Singaporean invoices/receipts. SST/GST-aware. Supports BM/EN/CN.

Security Scan

The skill's name and description promise invoice parsing, but the implementation and instructions only charge users and return tax rates — the actual parsing is expected to be done locally by the agent; this behavioural mismatch and use of a billing API key warrant caution.

Purpose & Capability

The skill is named and described as an 'Invoice & Receipt Parser' but the code and SKILL.md do not perform automated parsing of invoices. The runtime endpoint (/parse) only charges via SkillPay and returns tax rates; Step 2 explicitly tells the agent to 'use your own capabilities' to extract structured data. That makes the published name/description misleading: consumers might expect the skill to accept invoice images/text and return parsed JSON, but it does not.

Instruction Scope

SKILL.md instructs posting user_id to an external worker endpoint that charges and returns tax rates, and then tells the agent to parse invoices locally. The instructions do not request unrelated files or extra environment variables. However, the endpoint domain (my-sg-invoice-parser.swmengappdev.workers.dev) and billing flow mean calling the skill will bill the user; the docs indicate a payment_url may be returned on failure. There is no step that uploads invoice content to the skill, but the SKILL.md and code don't accept invoice data — parsing is performed client-side.

Install Mechanism

No install spec is provided (instruction-only install path), which is lower risk. Source includes code files and a wrangler.toml (Cloudflare Worker) but no packaged installer. The code imports '../../shared/billing' and '../../shared/types' which are not included in the manifest; that suggests reliance on platform-provided shared modules or omitted code — not an immediate security red flag, but it makes behavior at runtime partially opaque.

Credentials

Only SKILLPAY_API_KEY is required, which aligns with the skill's observable billing behavior. No unrelated credentials or filesystem paths are requested. That single credential is proportionate to the described payment/charging function, but it is sensitive and grants the skill the ability to charge via the SkillPay integration.

Persistence & Privilege

always is false and the skill does not request any elevated or persistent platform-wide privileges. There is no indication it modifies other skills or system-wide settings.

What to consider before installing

This skill is suspicious because it advertises 'invoice parsing' but actually only provides paid access to tax rates; the actual parsing is delegated to the agent. Before installing: (1) Verify the publisher and origin — the SKILL.md points to an external Cloudflare worker (swmengappdev.workers.dev) rather than an official homepage. (2) Treat SKILLPAY_API_KEY as sensitive: confirm its scope and minimum privileges (use a limited/test key if possible). (3) Ask the publisher for the full billing/shared code (the '../../shared/billing' module used by the worker is not in the package) so you can inspect where charges go and what endpoints are called. (4) If you expect server-side parsing, do not rely on this skill — it will not accept invoice images/text for parsing. (5) Test with a low-value or test account and confirm the payment flow before using with real users or production credentials.

Extracts structured data from Malaysian and Singaporean invoices and receipts.

How to Use This Skill

Step 1: Charge billing and get tax rates

POST to the skill endpoint to authorize payment and retrieve current tax rates:

POST https://my-sg-invoice-parser.swmengappdev.workers.dev/parse
Content-Type: application/json

{
  "user_id": "<user_id>",
  "country": "MY"
}

The endpoint charges billing and returns current tax rates:

{
  "success": true,
  "data": {
    "charged": true,
    "tax_rates": {
      "MY": {"service": 0.06, "sales": 0.10, "tourism": 0.08},
      "SG": {"gst": 0.09}
    }
  }
}

If payment fails, you'll receive a payment_url to share with the user.

Step 2: Parse the invoice

Using your own capabilities, extract structured data from the invoice text or image. Support these languages:

• Bahasa Malaysia (BM)
• English (EN)
• Chinese (CN) - Simplified and Traditional

For Malaysian invoices, detect:

• SST Registration Number (look for "SST No" or "SST Reg")
• Service Tax: 6%
• Sales Tax: 10%
• Tourism Tax: 8%

For Singaporean invoices, detect:

• GST Registration Number (look for "GST Reg" or "GST No")
• GST: 9%

Tax detection heuristics:

• If text contains "SST" followed by "No" or "Reg" → Malaysian SST
• If text contains "GST" followed by "Reg" or "No" → Singapore GST
• Use the tax rates from Step 1 for calculations

Step 3: Extract structured data

Extract the following fields:

• vendor: Business/company name
• items: Array of line items, each with:
  • description: Item name
  • quantity: Number of units
  • unit_price: Price per unit
  • total: Line total
• subtotal: Sum before tax
• tax_type: "MY_SST_service", "MY_SST_sales", "SG_GST", etc.
• tax_amount: Calculated tax amount
• total: Final total including tax
• currency: "MYR" for Malaysia, "SGD" for Singapore

Output Format

Return the parsed invoice as JSON:

{
  "vendor": "Restoran Nasi Kandar Line Clear",
  "items": [
    {"description": "Nasi Campur", "quantity": 2, "unit_price": 12.50, "total": 25.00},
    {"description": "Teh Tarik", "quantity": 2, "unit_price": 3.50, "total": 7.00}
  ],
  "subtotal": 32.00,
  "tax_type": "MY_SST_service",
  "tax_amount": 1.92,
  "total": 33.92,
  "currency": "MYR"
}

Pricing

$0.02 USDT per call via SkillPay.me